This HOWTO is designed to help you move a network from many different
clients speaking different languages, to many different machines that
speak a common language. The ultimate goal is to help differing
architectures and technologies, come together in a productive,
happily coexisting environment.

Following the directions outlined in this HOWTO should give you an
excellent step towards a peaceful cohabitation between Windows, and
virtually all known variations of *nix.

This HOWTO originally started not as a HOWTO, but as a FAQ. It was
intended to explore the functionality and power of the Gentoo system,
portage and the flexibility of USE flags. Like so many other projects,
it was quickly discovered what was missing in the Gentoo realm: there
weren't any Samba HOWTO's catered for Gentoo users. These users are
more demanding than most; they require performance, flexibility and
customization. This does not however imply that this HOWTO was not
intended for other distributions; rather that it was designed to work
with a highly customized version of Samba.

This HOWTO will describe how to share files and printers between Windows
PCs and *nix PCs. It will also demonstrate the use of the VFS (Virtual
File System) feature of Samba to incorporate automatic virus protection.
As a finale, it will show you how to mount and manipulate shares.

There are a few topics that will be mentioned, but are out of the
scope of this HOWTO. These will be noted as they are presented.

This HOWTO is based on a compilation and merge of an excellent HOWTO
provided in the Gentoo forums
by Andreas "daff" Ntaflos and the collected knowledge of Joshua Preston.
The link to this discussion is provided below for your reference:

HOWTO
CUPS+Samba: printing from Windows & Linux

Before you use this guide

There are a several other guides for setting up CUPS and/or Samba, please read
them as well, as they may tell you things left out of this HOWTO (intentional
or otherwise). One such document is the very useful and well written Gentoo Printing Guide, as configuration
issues and specific printer setup is not discussed here.

Brief Overview

After presenting the various USE flags, the following list will outline
all of the topics covered as they are presented:

On the Samba server:

Install and configure ClamAV

Install and configure Samba

Install and configure CUPS

Adding the printer to CUPS

Adding the PS drivers for the Windows clients

On the Unix clients:

Install and configure CUPS

Configuring a default printer

Mounting a Windows or Samba share

On the Windows Clients:

Configuring the printer

Accessing Samba shares

Requirements

We will need the following:

net-fs/samba

app-antivirus/clamav

net-print/cups

net-print/foomatic

net-print/hpijs (if you have an HP printer)

A kernel of sorts (preferably 2.4.24+ or 2.6.x)

A printer (PS or non-PS, maybe not TOO new or fancy)

A working network (home/office/etc) consisting of more than one machine)

The main package we use here is net-fs/samba, however, you will need
a kernel with smbfs support enabled in order to mount a samba or windows
share from another computer. CUPS will be emerged if it is not already.
app-antivirus/clamav will be used also, but others should be easily adapted
to work with Samba. Gentoo's samba ebuild supports all kinds of virus scanning
technologies, such as Sophos, FProt, Fsav, Trend, Icap, Nai, ...

Getting acquainted with SambaThe USE Flags

Before emerging anything, take a look at the various USE flags
available to Samba.

kerberos mysql xml acl cups ldap pam readline python oav libclamav

Depending on the network topology and the specific requirements of
the server, the USE flags outlined below will define what to include or
exclude from the emerging of Samba.

USE flag

Description

kerberos

Include support for Kerberos. The server will need this if it is
intended to join an existing domain or Active Directory. See the note
below for more information.

mysql

This will allow Samba to use MySQL in order to do password authentication.
It will store ACLs, usernames, passwords, etc in a database versus a
flat file. If Samba is needed to do password authentication, such as
acting as a password validation server or a Primary Domain Controller
(PDC).

xml

The xml USE option for Samba provides a password database backend allowing
Samba to store account details in XML files, for the same reasons listed in
the mysql USE flag description.

acl

Enables Access Control Lists. The ACL support in Samba uses a patched
ext2/ext3, or SGI's XFS in order to function properly as it extends more
detailed access to files or directories; much more so than typical *nix
GID/UID schemas.

cups

This enables support for the Common Unix Printing System. This
provides an interface allowing local CUPS printers to be shared to
other systems in the network.

ldap

Enables the Lightweight Directory Access Protocol (LDAP). If Samba is
expected to use Active Directory, this option must be used. This would
be used in the event Samba needs to login to or provide login to
a Domain/Active Directory Server. The kerberos USE flag is needed for
proper functioning of this option.

pam

Include support for pluggable authentication modules (PAM). This
provides the ability to authenticate users on the Samba Server, which is
required if users have to login to your server. The kerberos USE flag
is recommended along with this option.

readline

Link Samba against libreadline. This is highly recommended and should
probably not be disabled

python

Python bindings API. Provides an API that will allow Python to
interface with Samba.

A couple of things worth mentioning about the USE flags and different
Samba functions include:

ACLs on ext2/3 are implemented through extended attributes (EAs). EA and
ACL kernel options for ext2 and/or ext3 will need to be enabled
(depending on which file system is being used - both can be enabled).

While Active Directory, ACL, and PDC functions are out of the intended
scope of this HOWTO, you may find these links as helpful to your cause:

http://www.bluelightning.org/linux/samba_acl_howto/

http://www.wlug.org.nz/HowtoSamba3AndActiveDirectory

Server Software InstallationEmerging Samba

First of all: be sure that all your hostnames resolve correctly.
Either have a working domain name system running on your network
or appropriate entries in your /etc/hosts file.
cupsaddsmb often borks if hostnames don't point to the correct
machines.

Hopefully now you can make an assessment of what you'll actually need in
order to use Samba with your particular setup. The setup used for this
HOWTO is:

oav

cups

readline

pam

To optimize performance, size and the time of the build, the
USE flags are specifically included or excluded.

The following archs will need to add ~ to their KEYWORDS: x86,
ppc, sparc, hppa, ia64 and alpha

This will emerge Samba and CUPS (if CUPS is not already emerged).

Emerging ClamAV

Because the oav USE flag only provides an interface to allow on access
virus scanning, the actual virus scanner must be emerged. The scanner
used in this HOWTO is ClamAV.

# emerge app-antivirus/clamav

Emerging foomatic

# emerge net-print/foomatic

Emerging net-print/hpijs

You only need to emerge this if you use an HP printer.

# emerge net-print/hpijs

Server ConfigurationConfiguring Samba

The main Samba configuration file is /etc/samba/smb.conf.
It is divided in sections indicated by [sectionname]. Comments are either
# or ;. A sample smb.conf is included below with comments and
suggestions for modifications. If more details are required, see the
man page for smb.conf, the installed
smb.conf.example, the Samba Web site or any of the
numerous Samba books available.

[global]
# Replace MYWORKGROUPNAME with your workgroup/domain
workgroup = MYWORKGROUPNAME# Of course this has no REAL purpose other than letting
# everyone knows it's not Windows!
# %v prints the version of Samba we are using.
server string = Samba Server %v
# We are going to use cups, so we are going to put it in here ;-)
printcap name = cups
printing = cups
load printers = yes
# We want a log file and we do not want it to get bigger than 50kb.
log file = /var/log/samba/log.%m
max log size = 50
# We are going to set some options for our interfaces...
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
# This is a good idea, what we are doing is binding the
# samba server to our local network.
# For example, if eth0 is our local network device
interfaces = lo eth0
bind interfaces only = yes
# Now we are going to specify who we allow, we are afterall
# very security conscience, since this configuration does
# not use passwords!
hosts allow = 127.0.0.1 192.168.1.0/24
hosts deny = 0.0.0.0/0
# Other options for this are USER, DOMAIN, ADS, and SERVER
# The default is user
security = share
# No passwords, so we're going to use a guest account!
guest account = samba
guest ok = yes
# We now will implement the on access virus scanner.
# NOTE: By putting this in our [Global] section, we enable
# scanning of ALL shares, you could optionally move
# these to a specific share and only scan it.# For Samba 3.x. This enables ClamAV on access scanning.
vfs object = vscan-clamav
vscan-clamav: config-file = /etc/samba/vscan-clamav.conf
# Now we setup our print drivers information!
[print$]
comment = Printer Drivers
path = /etc/samba/printer # this path holds the driver structure
guest ok = yes
browseable = yes
read only = yes
# Modify this to "username,root" if you don't want root to
# be the only printer admin)
write list = root# Now we'll setup a printer to share, while the name is arbitrary
# it should be consistent throughout Samba and CUPS!
[HPDeskJet930C]
comment = HP DeskJet 930C Network Printer
printable = yes
path = /var/spool/samba
public = yes
guest ok = yes
# Modify this to "username,root" if you don't want root to
# be the only printer admin)
printer admin = root# Now we setup our printers share. This should be
# browseable, printable, public.
[printers]
comment = All Printers
browseable = no
printable = yes
writable = no
public = yes
guest ok = yes
path = /var/spool/samba
# Modify this to "username,root" if you don't want root to
# be the only printer admin)
printer admin = root# We create a new share that we can read/write to from anywhere
# This is kind of like a public temp share, anyone can do what
# they want here.
[public]
comment = Public Files
browseable = yes
public = yes
create mode = 0766
guest ok = yes
path = /home/samba/public

If you like to use Samba's guest account to do anything concerning
printing from Windows clients: don't set guest only = yes in
the [global] section. The guest account seems to cause
problems when running cupsaddsmb sometimes when trying to
connect from Windows machines. See below, too, when we talk about
cupsaddsmb and the problems that can arise. Use a dedicated
printer user, like printeruser or printer or
printme or whatever. It doesn't hurt and it will certainly
protect you from a lot of problems.
Turning on ClamAV on access scanning in the [global] section will slow
down the performance of your Samba server dramatically.

Now create the directories required for the minimum configuration of
Samba to share the installed printer throughout the network.

The configuration file specified to be used in smb.conf is
/etc/samba/vscan-clamav.conf. While these options are set
to the defaults, the infected file action may need to be changed.

[samba-vscan]
; run-time configuration for vscan-samba using
; clamd
; all options are set to default values; do not scan files larger than X bytes. If set to 0 (default),
; this feature is disable (i.e. all files are scanned)
max file size = 0
; log all file access (yes/no). If set to yes, every access will
; be logged. If set to no (default), only access to infected files
; will be logged
verbose file logging = no
; if set to yes (default), a file will be scanned while opening
scan on open = yes
; if set to yes, a file will be scanned while closing (default is yes)
scan on close = yes
; if communication to clamd fails, should access to file denied?
; (default: yes)
deny access on error = yes
; if daemon fails with a minor error (corruption, etc.),
; should access to file denied?
; (default: yes)
deny access on minor error = yes
; send a warning message via Windows Messenger service
; when virus is found?
; (default: yes)
send warning message = yes
; what to do with an infected file
; quarantine: try to move to quantine directory; delete it if moving fails
; delete: delete infected file
; nothing: do nothing
infected file action = delete; where to put infected files - you really want to change this!
; it has to be on the same physical device as the share!
quarantine directory = /tmp
; prefix for files in quarantine
quarantine prefix = vir-
; as Windows tries to open a file multiple time in a (very) short time
; of period, samba-vscan use a last recently used file mechanism to avoid
; multiple scans of a file. This setting specified the maximum number of
; elements of the last recently used file list. (default: 100)
max lru files entries = 100
; an entry is invalidated after lru file entry lifetime (in seconds).
; (Default: 5)
lru file entry lifetime = 5
; socket name of clamd (default: /var/run/clamd)
clamd socket name = /tmp/clamd
; port number the ScannerDaemon listens on
oav port = 8127

It is generally a good idea to start the virus scanner immediately. Add
it to the default runlevel and then start the clamd service
immediately. The service has two processes: freshclam keeps the virus definition
database up to date while clamd is the actual anti-virus daemon. First you may
want to set the paths of the logfiles so that it fits your needs.

This is a little more complicated. CUPS' main config file is
/etc/cups/cupsd.conf. It's structure is similar to Apache's
httpd.conf file, so many you may find it familiar. Outlined
in the example are the directives that need to be changed:

ServerName PrintServer# your printserver name
ServerAdmin root@PrintServer# the person for printer-related hate-mail, eg you
AccessLog /var/log/cups/access_log # probably doesn't need changing
ErrorLog /var/log/cups/error_log # doesn't really need changing either
LogLevel debug # only while isntalling and testing, should later be
# changed to 'info'
MaxClients 100 # I've had to set this to 1000000000 or so because some time back,
# there seemed to be a bug in CUPS' controlling of the web interface,
# making CUPS think a denial of service attack was in progress when
# I tried to configure a printer with the web interface. weird.
BrowseAddress @IF(eth0) # Change this to your internal net interface
<Location />
Order Deny,Allow
Deny From All
Allow From 192.168.1.*# the addresses of your internel network
# eg 192.168.1.* will allow connections from any host on
# the 192.168.1.0 network. change to whatever suits you
</Location>
<Location /admin>
AuthType Basic
AuthClass System
Allow From 192.168.1.*# same as above, allow any host on the
# 192.168.1.0 network to connect and do
# administrative tasks after authenticating
Order Deny,Allow
Deny From All
</Location>

Edit /etc/cups/mime.convs to uncomment some lines.
The changes to mime.convs and mime.types are
needed to make CUPS print Microsoft Office document files.

(The following line is found near the end of the file. Uncomment it)
application/octet-stream application/vnd.cups-raw 0

Edit /etc/cups/mime.types to uncomment some lines.

(The following line is found near the end of the file. Uncomment it)
application/octet-stream

First, go to LinuxPrinting.Org to
find and download the correct PPD file for your printer and CUPS. To do so,
click the link Printer Listings to the left. Select your printers manufacturer
and the model in the pulldown menu, eg HP and DeskJet 930C. Click "Show". On
the page coming up click the "recommended driver" link after reading the
various notes and information. Then fetch the PPD file from the next page,
again after reading the notes and introductions there. You may have to select
your printers manufacturer and model again. Reading the CUPS quickstart guide
is also very helpful when working with CUPS.

Now you have a PPD file for your printer to work with CUPS. Place it in
/usr/share/cups/model. The PPD for the HP DeskJet 930C was
named HP-DeskJet_930C-hpijs.ppd. You should now install the printer.
This can be done via the CUPS web interface or via command line. The web
interface is found at http://PrintServer:631 once CUPS is running.

Remember to adjust to what you have. Be sure to have the name
(-p argument) right (the name you set above during the Samba
configuration!) and to put in the correct usb:/dev/usb/blah,
parallel:/dev/blah or whatever device you are using for your
printer.

You should now be able to access the printer from the web interface
and be able to print a test page.

Installing the Windows printer drivers

Now that the printer should be working it is time to install the drivers
for the Windows clients to work. Samba 2.2 introduced this functionality.
Browsing to the print server in the Network Neighbourhood, right-clicking
on the printershare and selecting "connect" downloads the appropriate
drivers automagically to the connecting client, avoiding the hassle of
manually installing printer drivers locally.

There are two sets of printer drivers for this. First, the Adobe PS
drivers which can be obtained from Adobe
(PostScript printer drivers). Second, there are the CUPS PS drivers,
to be obtained from the
CUPS homepage and selecting "CUPS Driver for Windows" from the
pull down menu. There doesn't seem to be a difference between the
functionality of the two, but the Adobe PS drivers need to be extracted
on a Windows System since it's a Windows binary. Also the whole procedure
of finding and copying the correct files is a bit more hassle. The CUPS
drivers seem to support some options the Adobe drivers don't.

This HOWTO uses the CUPS drivers for Windows. The downloaded file is
called cups-samba-5.0rc2.tar.gz. Extract the files
contained into a directory.

cups-samba.ss is a TAR archive containing three files:
cups5.hlp, cupsdrvr5.dll and
cupsui5.dll. These are the actual driver files.

The script cups-samba.install may not work for all *nixes (ie FreeBSD)
because almost everything which is not part of the base system is
installed somewhere under the prefix /usr/local/. This
seems not to be the case for most things you install under GNU/Linux.
However, if your CUPS installation is somewhere other than
/usr/share/cups/ see the example below.

Suppose your CUPS installation resides under
/usr/local/share/cups/, and you want to install the drivers there.
Do the following:

The execution of this command often causes the most trouble.
Reading through the posts in this
thread.

Here are common errors that may happen:

The hostname given as a parameter for -h and -H
(PrintServer) often does not resolve correctly and doesn't
identify the print server for CUPS/Samba interaction. If an error
like: Warning: No PPD file for printer "CUPS_PRINTER_NAME" -
skipping! occurs, the first thing you should do is substitute
PrintServer with localhost and try it again.

The command fails with an NT_STATUS_UNSUCCESSFUL. This error message
is quite common, but can be triggered by many problems. It's unfortunately
not very helpful. One thing to try is to temporarily set security =
user in your smb.conf. After/if the installation completes
successfully, you should set it back to share, or whatever it was set to
before.

This should install the correct driver directory structure under
/etc/samba/printer. That would be
/etc/samba/printer/W32X86/2/. The files contained should
be the 3 driver files and the PPD file, renamed to YourPrinterName.ppd
(the name which you gave the printer when installing it (see above).

Pending no errors or other complications, your drivers are now
installed.

If you use only one printer, it will be your default printer. If your print
server manages several printers, your administrator will have defined a default
printer on the server. If you want to define a different default printer for
yourself, use the lpoptions command.

Just point your web browser to http://printserver:631 on the client if
you want to manage your printers and their jobs with a nice web interface.
Replace printserver with the name of the machine that acts as
your print server, not the name you gave to the cups print server if you used
different names.

Mounting a Windows or Samba share in GNU/Linux

Now is time to configure our kernel to support smbfs. Since I'm assumming we've
all compiled at least one kernel, we'll need to make sure we have all the right
options selected in our kernel. For simplicity sake, make it a module for ease
of use. It is the author's opinion that kernel modules are a good thing and
should be used whenever possible.

CONFIG_SMB_FS=m
CONFIG_SMB_UNIX=y

Then make the module/install it; insert them with:

# modprobe smbfs

Once the modules is loaded, mounting a Windows or Samba share is
possible. Use mount to accomplish this, as detailed below:

(The syntax for mounting a Windows/Samba share is:
mount -t smbfs [-o username=xxx,password=xxx] //server/share /mnt/point
If we are not using passwords or a password is not needed)
# mount -t smbfs //PrintServer/public /mnt/public(If a password is needed)
# mount -t smbfs -o username=USERNAME,password=PASSWORD //PrintServer/public /mnt/public

After you mount the share, you would access it as if it were a local
drive.

Printer Configuration for Windows NT/2000/XP clients

That's just a bit of point-and-click. Browse to
\\PrintServer and right click on the printer
(HPDeskJet930C) and click connect. This will download the drivers to
the Windows client and now every application (such as Word or Acrobat)
will offer HPDeskJet930C as an available printer to print to. :-)

Final NotesA Fond Farewell

Well that should be it. You should now have a successful printing enviroment
that is friendly to both Windows and *nix as well as a fully virus-free working
share!

Links and ResourcesLinks

These are some links that may help you in setting up, configuration and
troubleshooting your installation:

CUPS Homepage

Samba Homepage

LinuxPrinting dot Org

Kurt
Pfeifle's Samba Print HOWTO (
This HOWTO really covers ANYTHING and EVERYTHING
I've written here, plus a LOT more concerning CUPS and Samba, and
generally printing support on networks. A really interesting read,
with lots and lots of details)

FreeBSD Diary's CUPS Topic

Troubleshooting

See this
page from Kurt Pfeifle's "Printing Support in Samba 3.0"
manual. Lots of useful tips there! Be sure to look this one up
first, before posting questions and problems! Maybe the solution
you're looking for is right there.